Symfony broke BC in a patch release. Causing CORS (viaasm89/stack-cors) support in Drupal 8.2 to break:https://www.drupal.org/node/2823687.

Introduced at1404607 —#19321 (July 9, 2016)

Fun fact: Symfonyalso discovered this is a problem, and that iswhy it introducedRequest::isMethodCacheable() shortly after:

c43de7f —#20205 (October 13, 2016)

Whenpointing out that this broke BC, the answer was simplyRFC conformance. That's fine for a major release. Maybe even a minor. But definitely not a patch release.

This should be reverted from the Symfony 2.8.x branch.

#19321 is the culprit.